diff --git a/plugin/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ESNativeRealmMigrateTool.java b/plugin/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ESNativeRealmMigrateTool.java
index c031175b7af..d1437b50197 100644
--- a/plugin/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ESNativeRealmMigrateTool.java
+++ b/plugin/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ESNativeRealmMigrateTool.java
@@ -81,7 +81,11 @@ public class ESNativeRealmMigrateTool extends MultiCommand {
 
     public ESNativeRealmMigrateTool() {
         super("Imports file-based users and roles to the native security realm");
-        subcommands.put("native", new MigrateUserOrRoles());
+        subcommands.put("native", newMigrateUserOrRoles());
+    }
+
+    protected MigrateUserOrRoles newMigrateUserOrRoles() {
+        return new MigrateUserOrRoles();
     }
 
     /**
diff --git a/plugin/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java b/plugin/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java
index fe9206bafda..869bf0cb009 100644
--- a/plugin/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java
+++ b/plugin/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java
@@ -59,12 +59,20 @@ public class SetupPasswordTool extends MultiCommand {
     SetupPasswordTool(Function<Environment, CommandLineHttpClient> clientFunction,
                       CheckedFunction<Environment, KeyStoreWrapper, Exception> keyStoreFunction) {
         super("Sets the passwords for reserved users");
-        subcommands.put("auto", new AutoSetup());
-        subcommands.put("interactive", new InteractiveSetup());
+        subcommands.put("auto", newAutoSetup());
+        subcommands.put("interactive", newInteractiveSetup());
         this.clientFunction = clientFunction;
         this.keyStoreFunction = keyStoreFunction;
     }
 
+    protected AutoSetup newAutoSetup() {
+        return new AutoSetup();
+    }
+
+    protected InteractiveSetup newInteractiveSetup() {
+        return new InteractiveSetup();
+    }
+
     public static void main(String[] args) throws Exception {
         exit(new SetupPasswordTool().main(args, Terminal.DEFAULT));
     }
@@ -73,7 +81,7 @@ public class SetupPasswordTool extends MultiCommand {
      * This class sets the passwords using automatically generated random passwords. The passwords will be
      * printed to the console.
      */
-    private class AutoSetup extends SetupCommand {
+    class AutoSetup extends SetupCommand {
 
         AutoSetup() {
             super("Uses randomly generated passwords");
@@ -116,7 +124,7 @@ public class SetupPasswordTool extends MultiCommand {
     /**
      * This class sets the passwords using password entered manually by the user from the console.
      */
-    private class InteractiveSetup extends SetupCommand {
+    class InteractiveSetup extends SetupCommand {
 
         InteractiveSetup() {
             super("Uses passwords entered by a user");
diff --git a/plugin/src/test/java/org/elasticsearch/xpack/security/authc/esnative/ESNativeRealmMigrateToolTests.java b/plugin/src/test/java/org/elasticsearch/xpack/security/authc/esnative/ESNativeRealmMigrateToolTests.java
index 6775665c01a..b7e36d2f6c6 100644
--- a/plugin/src/test/java/org/elasticsearch/xpack/security/authc/esnative/ESNativeRealmMigrateToolTests.java
+++ b/plugin/src/test/java/org/elasticsearch/xpack/security/authc/esnative/ESNativeRealmMigrateToolTests.java
@@ -11,7 +11,9 @@ import org.apache.logging.log4j.Logger;
 import org.elasticsearch.cli.Command;
 import org.elasticsearch.cli.CommandTestCase;
 import org.elasticsearch.cli.MockTerminal;
+import org.elasticsearch.cli.Terminal;
 import org.elasticsearch.cli.Terminal.Verbosity;
+import org.elasticsearch.cli.UserException;
 import org.elasticsearch.common.Strings;
 import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.env.Environment;
@@ -24,6 +26,7 @@ import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Map;
 
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
@@ -36,7 +39,19 @@ public class ESNativeRealmMigrateToolTests extends CommandTestCase {
 
     @Override
     protected Command newCommand() {
-        return new ESNativeRealmMigrateTool();
+        return new ESNativeRealmMigrateTool() {
+            @Override
+            protected MigrateUserOrRoles newMigrateUserOrRoles() {
+                return new MigrateUserOrRoles() {
+
+                    @Override
+                    protected Environment createEnv(Terminal terminal, Map<String, String> settings) throws UserException {
+                        return new Environment(Settings.builder().put(settings).build());
+                    }
+
+                };
+            }
+        };
     }
 
     public void testUserJson() throws Exception {
diff --git a/plugin/src/test/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordToolTests.java b/plugin/src/test/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordToolTests.java
index 7563c2b887b..25f64552613 100644
--- a/plugin/src/test/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordToolTests.java
+++ b/plugin/src/test/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordToolTests.java
@@ -8,12 +8,15 @@ package org.elasticsearch.xpack.security.authc.esnative.tool;
 import org.elasticsearch.cli.Command;
 import org.elasticsearch.cli.CommandTestCase;
 import org.elasticsearch.cli.ExitCodes;
+import org.elasticsearch.cli.Terminal;
 import org.elasticsearch.cli.UserException;
 import org.elasticsearch.common.settings.KeyStoreWrapper;
 import org.elasticsearch.common.settings.SecureString;
+import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.common.xcontent.NamedXContentRegistry;
 import org.elasticsearch.common.xcontent.XContentParser;
 import org.elasticsearch.common.xcontent.json.JsonXContent;
+import org.elasticsearch.env.Environment;
 import org.elasticsearch.xpack.security.authc.esnative.ReservedRealm;
 import org.elasticsearch.xpack.security.user.ElasticUser;
 import org.elasticsearch.xpack.security.user.KibanaUser;
@@ -25,6 +28,7 @@ import org.mockito.Mockito;
 
 import java.io.IOException;
 import java.security.GeneralSecurityException;
+import java.util.Map;
 
 import static org.mockito.Matchers.anyString;
 import static org.mockito.Matchers.contains;
@@ -60,7 +64,29 @@ public class SetupPasswordToolTests extends CommandTestCase {
 
     @Override
     protected Command newCommand() {
-        return new SetupPasswordTool((e) -> httpClient, (e) -> keyStore);
+        return new SetupPasswordTool((e) -> httpClient, (e) -> keyStore) {
+
+            @Override
+            protected AutoSetup newAutoSetup() {
+                return new AutoSetup() {
+                    @Override
+                    protected Environment createEnv(Terminal terminal, Map<String, String> settings) throws UserException {
+                        return new Environment(Settings.builder().put(settings).build());
+                    }
+                };
+            }
+
+            @Override
+            protected InteractiveSetup newInteractiveSetup() {
+                return new InteractiveSetup() {
+                    @Override
+                    protected Environment createEnv(Terminal terminal, Map<String, String> settings) throws UserException {
+                        return new Environment(Settings.builder().put(settings).build());
+                    }
+                };
+            }
+
+        };
     }
 
     public void testAutoSetup() throws Exception {
diff --git a/plugin/src/test/java/org/elasticsearch/xpack/security/crypto/tool/SystemKeyToolTests.java b/plugin/src/test/java/org/elasticsearch/xpack/security/crypto/tool/SystemKeyToolTests.java
index 34ba29e2074..8ffb5b77469 100644
--- a/plugin/src/test/java/org/elasticsearch/xpack/security/crypto/tool/SystemKeyToolTests.java
+++ b/plugin/src/test/java/org/elasticsearch/xpack/security/crypto/tool/SystemKeyToolTests.java
@@ -10,7 +10,11 @@ import com.google.common.jimfs.Jimfs;
 import org.apache.lucene.util.IOUtils;
 import org.elasticsearch.cli.Command;
 import org.elasticsearch.cli.CommandTestCase;
+import org.elasticsearch.cli.Terminal;
+import org.elasticsearch.cli.UserException;
 import org.elasticsearch.common.io.PathUtilsForTesting;
+import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.env.Environment;
 import org.elasticsearch.xpack.XPackPlugin;
 import org.elasticsearch.xpack.security.crypto.CryptoService;
 import org.junit.After;
@@ -19,6 +23,7 @@ import java.nio.file.FileSystem;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.attribute.PosixFilePermission;
+import java.util.Map;
 import java.util.Set;
 
 public class SystemKeyToolTests extends CommandTestCase {
@@ -41,7 +46,14 @@ public class SystemKeyToolTests extends CommandTestCase {
 
     @Override
     protected Command newCommand() {
-        return new SystemKeyTool();
+        return new SystemKeyTool() {
+
+            @Override
+            protected Environment createEnv(Terminal terminal, Map<String, String> settings) throws UserException {
+                return new Environment(Settings.builder().put(settings).build());
+            }
+
+        };
     }
 
     public void testGenerate() throws Exception {